Re: Data in transit (with a twist)...

If your company handles sensitive data of the types mentioned (PCI, HIPAA), and if independent regulatory or business partner audits occur, be ready for negative findings regarding the security of the unencrypted media in transit. The company I work for had negative audit findings on that years ago, even though backup tapes and drives were being placed into locked metal boxes and then transported by a secure offsite storage vendor to a secure offsite storage facility. The concerns raised were around the plausibility of some of those metal containers "falling off" the truck in transit, or the data being accessed by rogue employees of the secure storage vendor. So we were forced to invest in tape backup encryption as well as in-line data storage encryptors, and now we have encrypted backups of storage-encrypted data that still is transported in locked metal containers.

However if you can somehow avoid that encryption overhead in the UK, then what you'll need (as evidentiary support of a secure process) are written policies and procedures that state something like;

- tape backups and other data storage devices will be locked in metal containers before being removed from the secure data center
- only [your company name] data center employees will have access to the keys to unlock the media transport containers
- logs will be created and maintained that track all transport container possession and movement, which will include a media inventory of each container that leaves or is returned to the secure data center

That's only a few high-level bullet points. You'd have to elaborate by adding a policy title, purpose section, scope section, policy detail/guidance section, personnel responsibilities section, enforcement section, and document revision history. Ideally your policy/procedure will stipulate the use of encryption, as well as the locked containers either in companion to media encryption or as the only control measure where encryption is not feasible. That way you account for the possibility of using encryption in the future.

Good luck. And be prepared to put forth the expense and effort of strengthening the security controls as time goes on. New regulations routinely come out that push the security bar higher, which dramatically increases the cost of doing business. It's unfortunate but that's the world we live in.

This is not so much a pen testing question (although perhaps you pen test
physical transfers) – but as many of you are absolute security experts, some
I assume will be CHECK/CREST approved – it is a valuable resource I’d like
to tap into for some general brainstorming and advice.

I need some best practice controls, ideally in the form of a best practice
checklist that will satisfy internal and external auditors - for when our
data is in transit. The twist is, I am not on about “In transit” in terms of
electronic transfer; – I am on about backup tapes and redundant drives
physically being transferred from one site to another. The data on such
falls into “fairly sensitive”, i.e. no credit card details, but a degree of
personal data non the less.

I’ve got 2 scenarios really –

(1) All “servers” and backup facilities are in a secure data centre (lets
say building A). When they are physically taken out of this environment and
transferred, I class this data and media as “vulnerable”, whereas on site,
in terms of physical security I have reasonable assurance the data is
“relatively safe”.

Redundant (those flagged as ready for disposal) drives out of the few
remaining physical servers (some process/store sensitive data) are initially
transferred to local HQ (building B). These drives ARENT encrypted. Also,
backup tapes (again NOT encrypted) are transferred from building A >
building B as part of disaster recovery ops.

(2) We also have building C which is where the main employees office is.

From here redundant IT kit, such as old PC’s are flagged up as ready for

collection. IT collect the kit and it is stored in building B. Once the
store in building B is high enough, a local 3rd party service will collect
the PC’s, and “data-wipe” them. Workstation drives ARENT encrypted. Laptop
devices ARE encrypted.

We need some procedural safeguards in all of this. Especially around
accountability, integrity, and confidentiality. I am struggling to locate a
really detailed best practice guide around physical collection, physical
transfer and storing of redundant hardware and backup media in an
unencrypted state. I assume this falls under “asset management” but again I
am struggling to find a comprehensive best practice checklist that I can
align procedures around. I want to align our procedures with best practice
in this area from a reputable source, but to my surprise there doesn’t seem
to be much out there. However, perhaps searching asset management is the
wrong terminology in IT circles.

The risks are obvious. We are essentially transferring highly sensitive data
from different sites in an unencrypted state (issue in itself). There are
accountability, integrity and confidentiality risks to the hardware AND data
resident on this media. There is also potential availability risks in
relation to the backup media, as well as the integrity and confidentiality
risks to the data and backup media. This must fall into compliance for
issues like PCI and HIPAA.

RE: Backups Failing with error code 0X80070458... In the backup log, I found "Unable to detect tape drive or tape ... The problem may cause be caused by backup device.... uninstall drivers for any removable storage devices (USB Hard Drives,... different media block sizes....(microsoft.public.windows.server.sbs)

[SUMMARY] Using tar to restore files backup up using Veritas Netbackup... Once you import the catalog data, you can select the files with Netbackup client softwre.... Step 1 is performed with the first form of the command shown above and recreates catalog entries for the backups that are on the specified media.... For example, if a backup is imported on 11/14/98 and its retention level is one week, its new expiration date is 11/21/98. ...(SunManagers)

Re: Backups Failing with error code 0X80070458... I renamed NTMSDATA & then restarted storage service & this allowed backups ... In the backup log, I found "Unable to detect tape drive or tape ... different media block sizes....(microsoft.public.windows.server.sbs)

RE: An inconsistency was encountered on the requested media... Drive and server itself before i post this message and I am looking ... I did try to backup manually as you directed before to troubleshoot script ...Microsoft CSS Online Newsgroup Support... Will enumerate on 3 media libraries found. ...(microsoft.public.windows.server.sbs)